Microsoft has released security updates for four Windows Remote Desktop Client vulnerabilities that can let attackers run code through network connections or local access. Published on November 10, 2026, the issues include memory handling errors and a race condition, and three of them use network attack paths while the fourth depends on existing local access.
Affected Windows Remote Desktop clients
Microsoft’s highest-scoring issue, CVE-2026-119934, has a CVSS score of 8.8 and an Important severity rating. The company describes it as a double-free bug, where the client releases the same memory area more than once. That can damage memory handling and let an attacker run code when the affected client processes a response from a malicious server. The attacker needs to host that server and persuade a user to connect, and user interaction is required.
CVE-2026-119858 is a heap-based buffer overflow that can let an unauthorized attacker execute code over a network. Microsoft says exploitation depends on specific conditions such as protocol settings or configurations, which narrows the chance of broad attacks but does not remove the need to update affected clients. The race-condition flaw, CVE-2026-95964, has a CVSS score of 7.5. It affects how client operations share a resource without proper synchronization, and successful exploitation requires winning the timing race. Microsoft says user interaction is required and rates exploitation as unlikely.
Remote code execution paths
The fourth issue, CVE-2026-119390, needs separate handling even though it is described as remote code execution. Microsoft’s technical description calls it a local heap-based buffer overflow that requires low privileges and no additional user interaction, and its CVSS score is 7.8. Treating it as an unauthenticated network attack would misstate the access needed to exploit it.
The table below lists the CVEs, their descriptions, and their severity ratings.
| CVE ID | Vulnerability | Severity |
|---|---|---|
| CVE-2026-119934 | Double-free RCE | High (8.8) |
| CVE-2026-119858 | Heap buffer and integer overflow RCE | High (7.5) |
| CVE-2026-119390 | Heap buffer overflow enabling local code execution | High (7.8) |
| CVE-2026-95964 | Race-condition RCE | High (7.5) |
Earlier client-side cases
Cyber Security News previously covered a Remote Desktop Client vulnerability that involved a malicious server and a different underlying weakness. That earlier case offers context, but it does not show that the newly disclosed flaws use the same attack method or have already been used against organizations.
Social engineering also makes the connection step relevant. Previous rogue RDP phishing campaigns used emailed connection files to steer victims toward attacker-controlled servers. Those campaigns abused remote resource sharing rather than these memory flaws. The connection is practical, but it does not prove a shared campaign, and attackers already have ways to get users to open unwanted remote sessions.
Windows versions and update guidance
Microsoft’s advisory for CVE-2026-119934 lists affected Windows 10, Windows 11, and Windows Server releases. Administrators are told to check each vulnerability’s product table instead of assuming one update covers every installation. The CVE-2026-119390 table also lists Windows App Client for Windows Desktop, and version 2.0.1489.0 is the fixed build for that product.
Security teams should deploy the matching updates and confirm installation across employee devices and administrative systems that use Remote Desktop connections. Microsoft reported no exploitation at publication for CVE-2026-119934, CVE-2026-119390, and CVE-2026-95964.
Licensed under CC BY-ND 4.0 International